kfreds

21 ms·

181.
by kfreds 3y ago
Not very closely, although I am aware of them. Are you involved? How would you relate RATS and SCITT to System Transparency, Sigsum and TKey?
182.
by kfreds 3y ago
You're absolutely right that almost all organizations have lower-hanging fruit to worry about than remote attestation, reproducible builds and transparency logging with distributed trust assumptions. Nor do they spend three years desig
183.
by kfreds 3y ago
> An HSM. Please please let it be an HSM ! :) That is one of the options we're considering, but please tell me more. :) What companies, communities or individuals are missing what features at what price point? The devil's advoc
184.
by kfreds 3y ago
Thank you! We actually started prototyping an open-source hardware TPM but put that project on the shelf to focus on what became the TKey. As you may know, in order to use the TKey as a TPM we'd have to design hardware that can connect
185.
by kfreds 3y ago
> Do you make any attempts to go further? Yes. At the moment we're targeting x86-64 servers with UEFI. On such platforms we aim to do the following: 1. UEFI does measurement and verification of stboot using UEFI Secure Boot 2. stboo
186.
by kfreds 3y ago
Neither remote attestation, decompilation of firmware blobs, reading the chip specification nor IOMMU are universal solutions to all security problems. They do however complement each other nicely. Imagine connecting to a Jitsi or Etherpad
187.
by kfreds 3y ago
Thank you, and I'm sorry about that. I did a talk recently at OSFC which is less vague, but still all over the place. Here's a link to the slides and video. https://www.osfc.io/2023/talks/towards-authenti
188.
by kfreds 3y ago
I invented System Transparency. Ask me anything. :) In short, System Transparency aims to make the reachable state space of a remote system discoverable. If that sounds interesting to you, be sure to check out these two related projects: Si
189.
by kfreds 3y ago
Great video! Thanks for the link. By the way, I was confused by how you equated architecture and RTL. In this context I use "architecture" to mean ISA. I use "microarchitecture" to refer to how e.g. its performance chara
190.
by kfreds 3y ago
> This is a critical topic right now for me The people and projects surrounding the OSFC has been working tirelessly for many years on changing things for the better. I can personally attest to the fact that the people involved are incre
191.
by kfreds 3y ago
> Open source firmware for what though? The conference's scope is open source firmware in general, as implied by its name. > I'm gonna assume this is PC firmware based on the list of players, but I haven't been able to
192.
by kfreds 3y ago
The OSFC is a great event with a friendly community. I highly recommend it to anyone interested in open source firmware. I'm beyond impressed with the hard work and passion of its participants. Many of them have worked tirelessly for y
193.
by kfreds 3y ago
> ISPs turning into jerks came on the heels of that. > ISPs learned how to be bad from security experts explaining how much mischief a person could get up to and deciding that sounded like a swell idea Telecommunications companies hav
194.
by kfreds 3y ago
The VPN market has had considerable growth year-to-year since at least 2009. It's just that in the last few years that growth has added up to big absolute numbers. Here's how I think about customer segments: * Those interested in
195.
by kfreds 3y ago
> one of the ways you can evaluate companies is to recognize when they're making sketchy, not-relevant claims to create an air of legitimacy. This is an excellent heuristic. Personally I like to evaluate trustworthiness in terms of
196.
by kfreds 3y ago
> What does masking specifically mean? Here's a complete list of settings and modifications: https://mullvad.net/en/browser/hard-facts
197.
by kfreds 3y ago
I'm sorry we haven't been more clear in our communication. Our decision to remove port forwarding was not a question of margins - it was a moral and practical decision. Port forwarding is a feature with many legitimate use cases.
198.
by kfreds 3y ago
Thank you. There is no need to be sorry. I'm grateful for the opportunity to clarify things.
199.
by kfreds 3y ago
There were several major issues.
200.
by kfreds 3y ago
FYI: Our decision to remove port forwarding was not a reaction to the surprise visit by Swedish police. I wish we had been more clear about this in our blog post.
201.
by kfreds 3y ago
I'm not sure whether we did or not. Please don't hesitate to contact support for a refund of remaining time in case you've decided to switch providers.
202.
by kfreds 3y ago
I sincerely apologize for the inconvenience we have caused you. Announcing the removal of a feature such as this a mere 30 days ahead is not how we like to conduct our business in the general case. I expect those of our customers who relied
203.
by kfreds 3y ago
Tillitis AB Our first product is the TKey - a new kind of USB security key - which we have been selling since May. TKey is very likely the most open source USB security key in the world, as well as the first one to feature unconditional mea
204.
by kfreds 3y ago
As I'm sure you're aware FPGAs are nice because they can complicate things for an attacker in the physical supply chain. Andrew "bunnie" Huang did an excellent talk on the subject: https://www.youtube.com&#x2F
205.
by kfreds 3y ago
You're spot on. TKey is based on ideas like TPM and DICE. Think of TKey as a TPM-in-time, and a discrete TPM on an x86 mainboard as a TPM-in-space. Both go through the load-hash-measure-trust/execute steps, but TKey only needs one
206.
by kfreds 4y ago
Thanks!
207.
by kfreds 4y ago
It's worth noting that System Transparency is a multi-year effort to bring transparency to running computer systems. We are aiming for what we call transparent servers. Just like there's open source software and open source hardwa
208.
by kfreds 4y ago
Ah, OK! :)
209.
by kfreds 4y ago
Note that we specifically chose the Lattice ice40 UltraPlus 5K because: - It is supported by an open-source FPGA toolchain - Has an in-package non-volatile configuration memory (NVCM) that is lockable. This is where we'll eventually ke
210.
by kfreds 4y ago
Hi! Interesting. Which company do you work for? Yes, that'd be possible. I don't know how webauthn works, but if it relies on ECC you could probably do ECDH between all security keys you wanted to carry your master key, and then u

More ›